The arrest of Pavel Durov, CEO of Telegram

I imagine everyone has now heard about the arrest of Pavel Durov, CEO of Telegram. Every major news outlet covered it, given the stir it caused. As is now customary, public opinion immediately split into two camps: those who see Durov as a victim of the system, probably the majority, and those who consider him a criminal, child abuser and drug dealer.

Unfortunately, we are used to every event becoming polarised. As soon as something makes the news, two factions form and immediately attack each other, pushing aside any real argument based on known facts. This case is no exception: both camps circulate inaccuracies that inevitably undermine their credibility.

As often happens, I find it difficult to take either side. The more information I look for, the harder it becomes to see things in black and white. I see more and more shades of grey.

The known facts

Let us briefly summarise what we know, without pretending to cover the whole story.

On Saturday 24 August, Pavel Durov was arrested in France. Initially little was known about the accusations; French prosecutors published them shortly afterwards. People immediately assumed violations of the DSA, and Telegram promptly issued a statement saying it complied with all European regulations:

When the allegations became public, the situation appeared potentially more serious. Among them were:

• Complicity in possessing and distributing child sexual abuse material.
• Complicity in acquiring, possessing and transporting drugs.
• Complicity in cybercrime.

This was mainly because Durov, who also holds French citizenship, allegedly refused to communicate with the authorities requesting information and cooperation to stop this activity.

A quick search would have revealed this, but I suspect most people expressing forceful opinions were unaware of even these basic details.

From the web

Clarifications

• This is not about privacy.
• This is not about freedom of speech.
• This is not about selling data.
• It is not even simply about illegal material and child sexual abuse material being present.
• It concerns what Durov and Telegram did or failed to do to cooperate with law enforcement and the judiciary, and to limit illegal uses of the platform.

Encryption

The assumption

I have kept end-to-end encryption separate because it is roughly my area of expertise. This message was just one of many circulating across social networks, from Facebook to LinkedIn. In theory, if its premise were correct, namely that all messages use end-to-end encryption, the conclusions would be broadly right. But the premise is wrong, as Telegram itself explains in its FAQ:

How do you encrypt data? Telegram describes two layers: server-client encryption for Cloud Chats, both private and group conversations, and an additional client-client layer for Secret Chats. Text, media and files are encrypted in the same way within each chat type.

Why not make all chats secret? Telegram explains that Secret Chats use client-client encryption, while Cloud Chats use client-server/server-client encryption and are stored encrypted in Telegram’s cloud. See its data storage explanation. This allows cloud messages to be both secure and accessible from all your devices, even if you lose a device entirely.

End-to-end encryption

A very short explanation of end-to-end encryption, usually abbreviated to E2E. As always, this is for a general audience rather than a technical paper, so some simplification is inevitable.

Also called client-client encryption, it encrypts and decrypts message content directly on the device, using keys previously exchanged by the two devices.

E2E encryption relies on exchanging encryption keys. These allow devices to encrypt or decrypt messages. The important point is that this happens on the device, ensuring that only sender and recipient can know the content.

Here is a small diagram that I hope clarifies the steps. First the devices exchange keys: each sends the public part of a key pair to the other so messages can be encrypted, while retaining the private part used for decryption. “Public” and “private” describe their roles well. Anyone can safely have our public key because it only allows them to encrypt a message. The private key must remain private because it decrypts the message, making it the most sensitive part of the process. If it is lost, the messages can no longer be decrypted.

I hope this makes it clearer why, if every Telegram chat used E2E encryption, Telegram itself could not retrieve the messages’ contents: it would not possess the private key, which stays on the device. Telegram’s FAQ explains why it chose not to use this encryption for every chat.

WhatsApp

A brief note about WhatsApp. Its operators made a different choice: all chats use E2E encryption. We can experience some of the resulting limitations ourselves:

• There is always a “primary” device, and when connecting through WhatsApp Web, the primary device must be connected for it to work. WhatsApp Web synchronises existing chats with the device because only that device can decrypt certain messages. WhatsApp’s servers do not store those messages, at least not in plaintext or a form they can decrypt themselves.
• If we join a group with existing messages, we cannot access those from before we joined. Groups also use E2E encryption: even if a message is the same for every member, it is encrypted differently for each one using their public key. Someone joining later will not have a copy encrypted with their public key.

Closing thoughts

When companies and people this powerful and influential are involved, there may easily be unofficial motivations behind the outcome we see. This article is not intended to take either side. I simply want to stress the importance of looking for at least some information before choosing a side, because things are often more complex than they appear.

I do not believe Durov is a martyr or a hero of free communication, nor am I certain the accusations against him are justified. I do not know enough about the law, the background or the facts to be sure. We can only hope justice is fair and the law is applied, and that where laws prove inadequate or wrong, steps are taken to correct them.